SMS OTP is coming under increasing pressure as phishing attacks evolve, security guidance tightens and customers expect authentication to be both stronger and less intrusive. What was once a default way to verify possession of a mobile number now sits in a very different security and customer experience environment.
Against that backdrop, Authsignal is launching Number Verify in partnership with Aduna, giving businesses another way to confirm possession of a mobile number without requiring the customer to receive or enter an SMS one-time passcode. Number Verification can be delivered through Network Based (SNA) verification or SIM Card based verification, depending on the network and implementation.
Why is SMS OTP under more scrutiny?
A one-time code is a secret that has to travel to the customer and then back into the authentication journey. That interaction creates opportunities for phishing and social engineering, where attackers can persuade customers to hand over a legitimate code before it expires.
Security guidance increasingly reflects those risks. NIST SP 800-63B-4 classifies authentication using the public switched telephone network, including SMS-based out-of-band authentication, as a restricted authenticator. Organizations using restricted methods need to provide alternatives and plan for how their authentication approach can evolve.
For businesses, particularly those operating in regulated environments, the direction matters. SMS OTP may continue to play a role in some journeys, but authentication strategies need to adapt as threats, standards and regulatory expectations change. Waiting until change is required leaves less room to design that transition on your own terms.
Why Number Verification is a positive shift
Number Verification removes the one-time passcode from eligible verification journeys. Instead of sending a secret to the customer and asking them to return it, possession of the mobile number can be confirmed without requiring a code to be entered. That creates a meaningful security advantage because there is no OTP for an attacker to obtain through phishing or social engineering techniques that depend on convincing someone to share their code.
For high-volume consumer journeys, removing the OTP step can also make a meaningful difference to the experience. Customers do not need to wait for a text message, leave the flow or manually enter a code, while verification can happen with less interruption at a point where even small amounts of friction can affect completion. Removing SMS delivery from eligible journeys also reduces dependence on delayed or failed messages, retries and the disruption they can create for the customer.
Taken together, Number Verification creates a smoother and more reliable authentication journey while giving businesses another secure signal they can use when the context is right. It is not a faster way to deliver an OTP. It removes the OTP interaction from the journey altogether.
Why network connectivity matters
One of the historical barriers to wider Number Verification adoption has been carrier coverage. Integrating directly with individual mobile operators can create technical and routing complexity, particularly for businesses operating across multiple markets.
Number Verify gives businesses access to carrier-based verification across millions of mobile connections, with coverage currently spanning 10 countries including the US, UK, Canada, France and Germany. As carrier connectivity continues to expand, businesses can introduce Number Verification across more customer journeys and markets without treating each network or geography as a separate authentication project.
That growing coverage makes Number Verification easier to incorporate as part of a broader authentication strategy, alongside passkeys, adaptive MFA and other verification methods.
Authentication is becoming a choice of building blocks
The pressure on SMS OTP is coming from several directions at once. Attack techniques are evolving, security guidance is changing and customers increasingly expect authentication to protect them without getting in their way.
The answer is unlikely to be replacing one universal default with another. Passkeys provide phishing-resistant authentication. Number Verification provides a possession signal without the OTP interaction. Biometrics, device intelligence and identity verification answer different questions again.
The value comes from making those methods work together. A routine interaction may require very little from the customer, while a change in risk can trigger stronger verification. Businesses need the flexibility to match the authentication method to the customer, context and level of risk.
Bringing Number Verification into Authsignal
Authsignal Number Verify brings Number Verification into the same drop-in authentication layer as passkeys, adaptive MFA and other authentication and verification methods.
That gives businesses another building block they can introduce into existing journeys without replacing the authentication infrastructure they already use. Rather than looking for a single replacement for SMS OTP, the stronger approach is to build a set of methods your rules can choose between, from passkeys for phishing-resistant authentication and Number Verification for a possession signal without a code, through to SIM swap detection and SMS OTP where needed.
For businesses still heavily dependent on SMS OTP, building that flexibility into the journey now creates more room to adapt as security expectations, customer expectations and regulation continue to change. Authentication does not need to depend on whether a code reaches the right device at the right time, and stronger methods can be stepped up when greater assurance is required.
Learn more about Number Verify
.svg)
.png)
